confers 0.4.0

//! Integration tests for remote configuration sources.
//!
//! These tests verify the remote configuration functionality including:
//! - HTTP polled sources
//! - etcd integration
//! - Consul integration
//! - TLS connections
//! - Authentication

#![cfg(feature = "remote")]

mod common;

use std::time::Duration;

use confers::remote::{HttpPolledSourceBuilder, PolledSource};

// ========================================
// HTTP Polled Source Tests (Existing)
// ========================================

/// Test that HttpPolledSourceBuilder requires a URL.
#[test]
fn test_builder_requires_url() {
    let result = HttpPolledSourceBuilder::new().build();
    assert!(result.is_err());

    let err = result.err().unwrap();
    assert!(matches!(err, confers::ConfigError::InvalidValue { .. }));
}

/// Test that HttpPolledSourceBuilder accepts valid URL.
#[test]
fn test_builder_accepts_url() {
    let source = HttpPolledSourceBuilder::new()
        .url("https://example.com/config.json")
        .build()
        .unwrap();

    assert_eq!(
        source.source_id().as_str(),
        "http:https://example.com/config.json"
    );
}

/// Test that custom poll interval is set correctly.
#[test]
fn test_builder_custom_interval() {
    let source = HttpPolledSourceBuilder::new()
        .url("https://example.com/config.json")
        .interval(Duration::from_secs(45))
        .build()
        .unwrap();

    assert_eq!(source.poll_interval(), Some(Duration::from_secs(45)));
}

/// Test that default poll interval is 60 seconds.
#[test]
fn test_default_poll_interval() {
    let source = HttpPolledSourceBuilder::new()
        .url("https://example.com/config.json")
        .build()
        .unwrap();

    // DEFAULT_POLL_INTERVAL is 60 seconds
    assert_eq!(source.poll_interval(), Some(Duration::from_secs(60)));
}

/// Test that format can be specified.
#[test]
fn test_builder_with_format() {
    use confers::loader::Format;

    let source = HttpPolledSourceBuilder::new()
        .url("https://example.com/config.toml")
        .format(Format::Toml)
        .build()
        .unwrap();

    // Just verify it builds successfully
    assert!(source.source_id().as_str().contains("example.com"));
}

/// Test that timeout can be specified.
#[test]
fn test_builder_with_timeout() {
    let source = HttpPolledSourceBuilder::new()
        .url("https://example.com/config.json")
        .timeout(Duration::from_secs(10))
        .build()
        .unwrap();

    // Just verify it builds successfully
    assert!(source.source_id().as_str().contains("example.com"));
}

/// Test URL formats.
#[test]
fn test_various_url_formats() {
    // Test with real public URL (www.example.com is reserved for documentation)
    let source = HttpPolledSourceBuilder::new()
        .url("https://www.example.com/config.json")
        .build()
        .unwrap();
    assert!(source.source_id().as_str().contains("www.example.com"));

    // HTTPS URL with path
    let source = HttpPolledSourceBuilder::new()
        .url("https://example.com/v1/config")
        .build()
        .unwrap();
    assert!(source.source_id().as_str().contains("example.com"));

    // URL with query string
    let source = HttpPolledSourceBuilder::new()
        .url("https://example.com/config?env=prod")
        .build()
        .unwrap();
    assert!(source.source_id().as_str().contains("env=prod"));
}

/// Test builder pattern chaining.
#[test]
fn test_builder_pattern() {
    use confers::loader::Format;

    let source = HttpPolledSourceBuilder::new()
        .url("https://example.com/config.yaml")
        .interval(Duration::from_secs(30))
        .format(Format::Yaml)
        .timeout(Duration::from_secs(5))
        .build()
        .unwrap();

    assert_eq!(source.poll_interval(), Some(Duration::from_secs(30)));
}

/// Test PolledSource trait object creation.
#[test]
fn test_trait_object() {
    let source: Box<dyn PolledSource> = Box::new(
        HttpPolledSourceBuilder::new()
            .url("https://example.com/config.json")
            .build()
            .unwrap(),
    );

    // Can call trait methods on trait object
    let _source_id = source.source_id();
    let _interval = source.poll_interval();
}

// ========================================
// Security Tests - SSRF Protection
// ========================================

/// Test that HTTP URLs are rejected.
#[test]
fn test_http_url_rejected() {
    let result = HttpPolledSourceBuilder::new()
        .url("http://example.com/config.json")
        .build();

    assert!(result.is_err());
}

/// Test that private IP addresses are rejected (4.1.5 - TLS/IP security).
#[test]
fn test_private_ip_rejected() {
    // Localhost
    let result = HttpPolledSourceBuilder::new()
        .url("https://127.0.0.1/config.json")
        .build();
    assert!(result.is_err());

    // Private network 10.x.x.x
    let result = HttpPolledSourceBuilder::new()
        .url("https://10.0.0.1/config.json")
        .build();
    assert!(result.is_err());

    // Private network 192.168.x.x
    let result = HttpPolledSourceBuilder::new()
        .url("https://192.168.1.1/config.json")
        .build();
    assert!(result.is_err());

    // Private network 172.16.x.x
    let result = HttpPolledSourceBuilder::new()
        .url("https://172.16.0.1/config.json")
        .build();
    assert!(result.is_err());
}

/// Test that invalid URLs are rejected.
#[test]
fn test_invalid_url_rejected() {
    let result = HttpPolledSourceBuilder::new()
        .url("not-a-valid-url")
        .build();
    assert!(result.is_err());
}

/// Test that empty URL is rejected.
#[test]
fn test_empty_url_rejected() {
    let result = HttpPolledSourceBuilder::new().url("").build();
    assert!(result.is_err());
}

// ========================================
// Etcd Integration Tests (4.1.1, 4.1.2, 4.1.3, 4.1.7)
// ========================================

#[cfg(feature = "etcd")]
mod etcd_tests {
    use super::*;
    use confers::remote::{EtcdSourceBuilder, EtcdTlsConfig};

    /// Test EtcdSourceBuilder default configuration (4.1.1).
    #[test]
    fn test_etcd_builder_default() {
        let builder = EtcdSourceBuilder::new();
        // Just verify the builder can be created
        let _ = builder;
    }

    /// Test EtcdSourceBuilder endpoint configuration.
    #[test]
    fn test_etcd_builder_endpoints() {
        let builder = EtcdSourceBuilder::new()
            .endpoint("etcd1.example.com:2379")
            .endpoints(vec![
                "etcd2.example.com:2379".to_string(),
                "etcd3.example.com:2379".to_string(),
            ]);

        // Just verify the builder can be constructed
        let _ = builder;
    }

    /// Test EtcdSourceBuilder authentication (4.1.2).
    #[test]
    fn test_etcd_builder_auth() {
        let builder = EtcdSourceBuilder::new()
            .username("testuser")
            .password("testpass");

        // Just verify the builder can be constructed
        let _ = builder;
    }

    /// Test EtcdSourceBuilder prefix configuration.
    #[test]
    fn test_etcd_builder_prefix() {
        let builder = EtcdSourceBuilder::new().prefix("my-app-config");

        // Just verify the builder can be constructed
        let _ = builder;
    }

    /// Test EtcdSourceBuilder interval configuration.
    #[test]
    fn test_etcd_builder_interval() {
        let _builder = EtcdSourceBuilder::new().interval(Duration::from_secs(45));
    }

    /// Test EtcdSourceBuilder TLS configuration.
    #[test]
    fn test_etcd_builder_tls() {
        let tls_config = EtcdTlsConfig {
            ca_file: "/path/to/ca.pem".to_string(),
            cert_file: "/path/to/cert.pem".to_string(),
            key_file: "/path/to/key.pem".to_string(),
        };

        let _builder = EtcdSourceBuilder::new().tls(tls_config);

        // Just verify the builder can be constructed
    }

    /// Test EtcdSourceBuilder chaining.
    #[test]
    fn test_etcd_builder_chaining() {
        let builder = EtcdSourceBuilder::new()
            .endpoint("etcd.example.com:2379")
            .username("admin")
            .password("secret")
            .prefix("my-app")
            .interval(Duration::from_secs(60));

        // Just verify the builder can be constructed
        let _ = builder;
    }

    /// Test EtcdSourceBuilder can be constructed with invalid endpoint (4.1.3).
    /// build() calls Client::connect() but the etcd-client SDK lazily connects —
    /// it does not validate DNS/TCP reachability at build time, so build()
    /// succeeds even for invalid hostnames. Actual connection errors surface
    /// only when fetching data.
    #[tokio::test]
    async fn test_etcd_invalid_endpoint() {
        let builder = EtcdSourceBuilder::new()
            .endpoint("invalid-hostname:2379")
            .prefix("test");

        // T-C-1 A2: the original `is_ok() || is_err()` was tautological.
        // build() succeeds because etcd-client defers actual connection.
        let source = builder
            .build()
            .await
            .expect("build() should succeed even with an invalid endpoint (lazy connect)");
        // Verify the source was actually constructed with a valid source_id.
        let _sid = source.source_id();
    }

    /// Test EtcdSourceBuilder with non-existent port (4.1.3).
    /// Same as above: build() succeeds because etcd-client connects lazily.
    #[tokio::test]
    async fn test_etcd_connection_failure() {
        let builder = EtcdSourceBuilder::new()
            .endpoint("127.0.0.1:9999") // Non-existent port
            .prefix("test");

        // T-C-1 A3: the original `is_ok() || is_err()` was tautological.
        // build() succeeds; the TCP failure would only surface on fetch.
        let source = builder
            .build()
            .await
            .expect("build() should succeed even with a closed port (lazy connect)");
        let _sid = source.source_id();
    }

    /// Test Etcd environment variable authentication (4.1.2).
    #[test]
    fn test_etcd_auth_env_var() {
        // Test that auth can be set via environment
        common::with_env_var("ETCD_USERNAME", "env_user", || {
            common::with_env_var("ETCD_PASSWORD", "env_pass", || {
                let builder = EtcdSourceBuilder::new()
                    .username("ETCD_USERNAME")
                    .password("ETCD_PASSWORD");

                // Just verify the builder can be constructed
                let _ = builder;
            });
        });
    }

    /// Test Etcd source with TLS (4.1.5).
    #[tokio::test]
    async fn test_etcd_tls_connection() {
        let tls_config = EtcdTlsConfig {
            ca_file: "/nonexistent/ca.pem".to_string(),
            cert_file: "/nonexistent/cert.pem".to_string(),
            key_file: "/nonexistent/key.pem".to_string(),
        };

        let builder = EtcdSourceBuilder::new()
            .endpoint("localhost:2379")
            .tls(tls_config)
            .prefix("test");

        // Builder should accept the TLS config without error. TLS cert files
        // are not validated at build time (only during connect), so build()
        // succeeding verifies the builder stores the config correctly.
        let result = builder.build().await;
        assert!(
            result.is_ok(),
            "builder should accept TLS config, but build failed: {:?}",
            result.err()
        );
    }
}

// ========================================
// Consul Integration Tests (4.1.4, 4.1.5)
// ========================================

#[cfg(feature = "consul")]
mod consul_tests {
    use super::*;
    use confers::remote::ConsulSourceBuilder;

    /// Test ConsulSourceBuilder default configuration (4.1.4).
    #[test]
    fn test_consul_builder_default() {
        let builder = ConsulSourceBuilder::new();
        // Just verify the builder can be created
        let _ = builder;
    }

    /// Test ConsulSourceBuilder address configuration.
    #[test]
    fn test_consul_builder_address() {
        let builder = ConsulSourceBuilder::new().address("consul.example.com:8500");
        // Just verify the builder can be constructed
        let _ = builder;
    }

    /// Test ConsulSourceBuilder token authentication.
    #[test]
    fn test_consul_builder_token() {
        let builder = ConsulSourceBuilder::new().token("my-consul-token");
        // Just verify the builder can be constructed
        let _ = builder;
    }

    /// Test ConsulSourceBuilder prefix configuration.
    #[test]
    fn test_consul_builder_prefix() {
        let builder = ConsulSourceBuilder::new().prefix("my-app-config");
        // Just verify the builder can be constructed
        let _ = builder;
    }

    /// Test ConsulSourceBuilder interval configuration.
    #[test]
    fn test_consul_builder_interval() {
        let builder = ConsulSourceBuilder::new().interval(Duration::from_secs(45));
        // Just verify the builder can be constructed
        let _ = builder;
    }

    /// Test ConsulSourceBuilder TLS configuration (4.1.5).
    #[test]
    fn test_consul_builder_tls_skip_verify_debug() {
        let builder = ConsulSourceBuilder::new().tls_skip_verify(true);

        // In debug builds, this should be set
        #[cfg(debug_assertions)]
        {
            // Just verify the builder can be constructed
            let _ = builder;
        }
    }

    /// Test ConsulSourceBuilder chaining.
    #[test]
    fn test_consul_builder_chaining() {
        let builder = ConsulSourceBuilder::new()
            .address("consul.example.com:8500")
            .token("my-token")
            .prefix("my-app")
            .interval(Duration::from_secs(60));

        // Just verify the builder can be constructed
        let _ = builder;
    }

    /// Test Consul connection failure handling.
    #[tokio::test]
    async fn test_consul_connection_failure() {
        let builder = ConsulSourceBuilder::new()
            .address("127.0.0.1:9999") // Non-existent port
            .prefix("test");

        let source = builder.build().expect("Builder should succeed");

        // Poll should fail with connection error
        let result = source.poll().await;
        assert!(result.is_err());
    }

    /// Test Consul with TLS config (4.1.5).
    #[test]
    fn test_consul_tls_config() {
        use confers::remote::ConsulTlsConfig;

        let tls_config = ConsulTlsConfig {
            ca_file: "/path/to/ca.pem".to_string(),
            cert_file: "/path/to/cert.pem".to_string(),
            key_file: "/path/to/key.pem".to_string(),
        };

        // Just verify TLS config struct works
        assert_eq!(tls_config.ca_file, "/path/to/ca.pem");
        assert_eq!(tls_config.cert_file, "/path/to/cert.pem");
        assert_eq!(tls_config.key_file, "/path/to/key.pem");
    }
}

// ========================================
// Etcd Integration Tests with Real Server (Skipped if unavailable)
// ========================================

/// Test etcd connection (4.1.1) - skips if not available.
#[cfg(feature = "etcd")]
#[tokio::test]
async fn test_etcd_source_connect() {
    // Skip if Etcd is not available
    if !common::is_service_available("http://127.0.0.1:2379/health", Duration::from_secs(2)).await {
        eprintln!("Skipping test: Etcd not available");
        return;
    }

    use confers::remote::EtcdSourceBuilder;

    let source = EtcdSourceBuilder::new()
        .endpoint("127.0.0.1:2379")
        .prefix("test-config")
        .interval(Duration::from_secs(10))
        .build()
        .await
        .expect("Failed to build Etcd source");

    let result = source.poll().await;

    // Should not panic - either returns config or error
    match result {
        Ok(config) => {
            println!("Got config: {:?}", config);
        }
        Err(e) => {
            println!("Expected error (no config): {:?}", e);
        }
    }
}

/// Test etcd with authentication (4.1.2) - skips if not available.
#[cfg(feature = "etcd")]
#[tokio::test]
async fn test_etcd_source_with_auth() {
    if !common::is_service_available("http://127.0.0.1:2379/health", Duration::from_secs(2)).await {
        eprintln!("Skipping test: Etcd not available");
        return;
    }

    use confers::remote::EtcdSourceBuilder;

    // Connect without auth (default for dev)
    let source = EtcdSourceBuilder::new()
        .endpoint("127.0.0.1:2379")
        .prefix("test-config")
        .build()
        .await
        .expect("Failed to build Etcd source");

    let result = source.poll().await;
    println!("Poll result: {:?}", result);
}

/// Test etcd source configuration parsing - skips if not available.
#[cfg(feature = "etcd")]
#[tokio::test]
async fn test_etcd_source_parse_config() {
    if !common::is_service_available("http://127.0.0.1:2379/health", Duration::from_secs(2)).await {
        eprintln!("Skipping test: Etcd not available");
        return;
    }

    use confers::remote::EtcdSourceBuilder;

    // Write test config to Etcd using HTTP API directly
    let client = reqwest::Client::new();

    // Write host key
    let host_resp = client
        .post("http://127.0.0.1:2379/v3/kv/put")
        .json(&serde_json::json!({
            "key": "dGVzdC1jb25maWcvYXBwL2hvc3Q=",  // "test-config/app/host"
            "value": "bG9jYWxob3N0"  // "localhost"
        }))
        .send()
        .await;

    if host_resp.is_err() {
        eprintln!("Failed to write test config to Etcd");
        return;
    }

    // Now read it back using our source
    let source = EtcdSourceBuilder::new()
        .endpoint("127.0.0.1:2379")
        .prefix("test-config")
        .build()
        .await
        .expect("Failed to build Etcd source");

    let result = source.poll().await;

    match result {
        Ok(config) => {
            println!("Got config: {:?}", config);
            assert!(!config.is_empty(), "Config should not be empty");
        }
        Err(e) => {
            println!("Error: {:?}", e);
        }
    }

    // Cleanup
    let _ = client
        .post("http://127.0.0.1:2379/v3/kv/del")
        .json(&serde_json::json!({
            "key": "dGVzdC1jb25maWc="
        }))
        .send()
        .await;
}

// ========================================
// Consul Integration Tests with Real Server (Skipped if unavailable)
// ========================================

/// Test Consul connection (4.1.4) - skips if not available.
#[cfg(feature = "consul")]
#[tokio::test]
async fn test_consul_source_connect() {
    if !common::is_service_available(
        "http://127.0.0.1:8500/v1/status/leader",
        Duration::from_secs(2),
    )
    .await
    {
        eprintln!("Skipping test: Consul not available");
        return;
    }

    use confers::remote::ConsulSourceBuilder;

    let source = ConsulSourceBuilder::new()
        .address("127.0.0.1:8500")
        .prefix("test-config")
        .interval(Duration::from_secs(10))
        .build()
        .expect("Failed to build Consul source");

    let result = source.poll().await;

    match result {
        Ok(config) => {
            println!("Got config: {:?}", config);
        }
        Err(e) => {
            println!("Expected error (no config): {:?}", e);
        }
    }
}

/// Test Consul source with token - skips if not available.
#[cfg(feature = "consul")]
#[tokio::test]
async fn test_consul_source_with_token() {
    if !common::is_service_available(
        "http://127.0.0.1:8500/v1/status/leader",
        Duration::from_secs(2),
    )
    .await
    {
        eprintln!("Skipping test: Consul not available");
        return;
    }

    use confers::remote::ConsulSourceBuilder;

    let source = ConsulSourceBuilder::new()
        .address("127.0.0.1:8500")
        .prefix("test-config")
        .build()
        .expect("Failed to build Consul source");

    let result = source.poll().await;
    println!("Poll result: {:?}", result);
}

/// Test Consul source configuration parsing - skips if not available.
#[cfg(feature = "consul")]
#[tokio::test]
async fn test_consul_source_parse_config() {
    if !common::is_service_available(
        "http://127.0.0.1:8500/v1/status/leader",
        Duration::from_secs(2),
    )
    .await
    {
        eprintln!("Skipping test: Consul not available");
        return;
    }

    use confers::remote::ConsulSourceBuilder;

    let http_client = reqwest::Client::new();

    // Write a test key
    let put_result: Result<reqwest::Response, _> = http_client
        .put("http://127.0.0.1:8500/v1/kv/test-config/app")
        .body(r#"{"host": "localhost", "port": 8080}"#)
        .send()
        .await;

    if put_result.is_err() {
        eprintln!("Failed to write test config to Consul");
        return;
    }

    // Now read it back
    let source = ConsulSourceBuilder::new()
        .address("127.0.0.1:8500")
        .prefix("test-config")
        .build()
        .expect("Failed to build Consul source");

    let result = source.poll().await;

    match result {
        Ok(config) => {
            println!("Got config: {:?}", config);
            assert!(!config.is_empty(), "Config should not be empty");
        }
        Err(e) => {
            println!("Error: {:?}", e);
        }
    }

    // Cleanup
    let _ = http_client
        .delete("http://127.0.0.1:8500/v1/kv/test-config")
        .send()
        .await;
}